3 ms·
The trouble is that normal operations are often indistinguishable from social engineering. I have worked several places where I have been told by management th
by ktizo 14y ago
The trouble is that normal operations are often indistinguishable from social engineering.
I have worked several places where I have been told by management that something needs fixed on a web server, but they can't remember any passwords, so could I call up their ISP and just get it sorted.
In these situations, I have never had to prove anything I couldn't have faked and I usually get asked to provide an email address so they can send me the details.
As this kind of behaviour seems very common, most everything seems to be wide open for social engineering. So given that everything isn't hacked all of the time, people in general must be both much nicer and much lazier than I had otherwise assumed.
- jared314 14y ago"Your security is based on the kindness, and apathy, of strangers." I repeat that warning to anyone who has become just computer-savvy enough to use a computer as well as they drive their car. The tinfoil-hat jokes have tapered off, over the years, with the mainstream news coverage of stolen user information.
- ktizo 14y agoI like that paraphrase, mind if I nick it?
- jurjenh 14y agoJust had a reminder of that this morning... Was doing a bit of routine maintenance on the server at work when I noticed repeated ssh login attempts appearing in the system logs... with usernames that clearly don't exist. Tracing the source ip address sent me to Beijing somewhere, so someone there was trying a port scan and random ssh login attempts. I've never really looked for this kind of interaction before, and I wonder just how common it is these days - but I'd say that you can now pretty much guarantee that it will happen at some stage, and you'd better hope your security is up to the task.
- nitrogen 14y agoIt even happens if you just open port 22 on your home router. You can use things like fail2ban to put a short-term ban on offending addresses, and put your ssh server on a random (i.e. not 2222) high numbered port to reduce automated scans.
- oofabz 14y agoIt is so common I'd be surprised if you weren't seeing these login attempts. Every ssh server I've run in the last 10 years has had this happen, even those without domain names. They must just scan random IPv4 addresses for anyone responding on port 22. It's the modern equivalent of wardialing.